Security audit

碎片知识缝纫师

Security checks for vulnerabilities and agentic risk

Overview

This skill locally organizes user-provided notes and files; no hidden execution, exfiltration, or privilege persistence was found.

Before installing, treat this as a local note-ingestion and persistence tool: do not feed it secrets, private chats, or sensitive business files unless you are comfortable storing them in the configured knowledge base. Prefer explicit user confirmation before reading local file paths or saving collected fragments, and review/delete the generated knowledge files when needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a broader knowledge reorganization system centered on collection plus association discovery, stitching related fragments together, and outline generation. The supplied code only covers the collection/structuring portion: ingesting text/files/provided web content, extracting heuristic summaries and concepts, persisting fragments, and keyword-style search. Although fragment objects contain placeholder fields like related_fragments and stitch_notes, the code never fills them. There is also no clustering/topic accumulation logic or outline drafting. This is therefore a material description-behavior mismatch: the implemented behavior is a subset of the declared functionality, with the primary advanced capabilities absent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个较完整的知识整理与关联重组工具，包含收集、关联发现、知识缝纫和大纲生成四类核心场景。当前代码块实际只覆盖其中一小部分：当某主题相关碎片数量达到阈值时，基于 tags、content 和 key_concepts 做简单关键词匹配与计数分析，然后套用技术/业务/通用模板生成结构化大纲，并可导出 Markdown。此外还提供了 PRD 草案生成功能。代码没有任何外部数据接入或采集逻辑，也没有相似度计算、关系推理、链接笔记生成等“知识关联/缝合”实现。因此，代码的实际能力明显窄于声明，且包含一个额外的 PRD 生成功能，属于描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明描述的是一个覆盖“收集—关联发现—知识缝合—知识重组/大纲生成”的综合工具，但该代码块的实际职责明显更窄，核心是把已有关系转写为连接笔记。虽然它与“生成知识连接笔记”这一子能力高度一致，也部分支持知识关联结果的表达，但它并未实现声明中的几个关键主能力：1）没有任何微信、网页、文档、会议记录等来源的采集或导入逻辑；2）没有真正的体系化整理或知识库重组机制；3）“发现新内容与已有知识库的关联”并非由本代码完成，而是依赖外部relationship_finder；4）没有“碎片积累足够多时自动生成大纲草案”的实现。相反，代码还包含PRD补充建议和每周知识摘要等额外输出功能，这些不属于声明中的重点能力。因此，描述对该代码块的能力范围有明显夸大，存在实质性不匹配。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly promotes collecting and storing content from chats, webpages, documents, screenshots, local files, and URLs, but it does not warn users about the privacy and security implications of ingesting potentially sensitive data. In the context of an agent skill, this can lead users to expose confidential information or cause the system to process untrusted local/remote content without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation advertises automatic file-path reads and URL fetching without warning that these actions may access sensitive local data or retrieve malicious/untrusted remote content. In a skill that encourages ad hoc ingestion from arbitrary sources, this increases the risk of privacy leakage, unintended local file exposure, SSRF-like network access patterns, or processing of hostile content.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to read from and write to local directories and references OCR/web inputs, but it declares no explicit tool scope or permission boundaries. That creates an authorization ambiguity where a host system may grant broader file or network access than the user expects, increasing the chance of unintended data exposure or modification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description lists broad activation scenarios such as "整理碎片"、"知识关联"、"知识重组"、"构建知识体系" without defining clear boundaries, exclusions, or explicit trigger phrases. These terms are generic enough to overlap with many ordinary note-taking or brainstorming requests, which could cause unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly directs persistent writes into a local knowledge directory without warning the user or obtaining consent. This can lead to silent modification of local files, accidental retention of sensitive notes, and trust boundary violations if users believe the interaction is ephemeral.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file’s natural-language descriptions, docstrings, and user-facing strings are entirely in Chinese, with no indication that language is configurable or that the skill is intentionally limited to a Chinese-only audience. Under the stated policy, forcing a specific language without user opt-in is a locale-policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill stores collected fragment contents directly to disk in fragments.json without any consent flow, disclosure, redaction, or retention controls. Because this tool is explicitly designed to ingest scattered notes, web content, documents, and meeting records, it is likely to handle sensitive personal or proprietary data, making silent persistence a real privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains natural-language descriptions and messages exclusively in Chinese, including the module docstring and later user-facing strings. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes collecting fragments, finding relationships, generating connection notes, and producing outline drafts when enough material accumulates. This code adds a dedicated generate_prd_draft feature that creates a product requirements document structure, which is a distinct product-management authoring capability not justified by the stated purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This Python file contains natural-language descriptions and user-facing strings entirely in Chinese, beginning with the module docstring and continuing throughout the file. Because the skill does not offer any language or locale selection, it may violate a language/locale policy requiring user choice rather than forcing a specific language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file contains natural-language content exclusively in Chinese in the module docstring, comments, docstrings, and printed output. Because the skill does not offer a user language/locale choice or explain that it is intentionally region- or language-specific, it appears to impose a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language docstrings and user-facing strings exclusively in Chinese, including the module description and generated note text. The file does not indicate that the skill is region-specific or provide any user opt-in for language selection, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes collecting fragments, discovering relationships, generating connection notes, and producing outlines when enough material accumulates. This function specifically generates 'PRD 补充建议' by classifying related fragments into requirements, risks, and technical solutions, which is a product-document authoring feature not stated in the manifest.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README is entirely written in Chinese and all example prompts and outputs are Chinese, with no indication that other languages are supported or that Chinese is an optional locale. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill’s name, description, workflow, and example responses are entirely in Chinese, indicating an implicit language constraint. There is no statement that users may choose another language or that the Chinese-only behavior is intentionally limited to a specific locale or audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all instructions and field descriptions only in Chinese, which can amount to a language policy issue when users are not given an opt-in or alternative locale. The content does not indicate that the skill is intended only for a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The module docstring frames this script as an outline-draft generator for accumulated topic fragments. In addition to outline generation, the implementation provides generate_markdown and generate_prd_draft, expanding behavior beyond what the documentation claims this script does.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The top-level documentation presents the script as a note generator that helps users understand relationships between fragments. In batch mode, however, the code performs an in-place update to each fragment via fragment['stitch_notes'].append(note), introducing a state-changing side effect not reflected by the documented intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.